recoup-music-video

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes npx to run the hyperframes utility (version 0.7.5) for project linting, validation, and snapshotting tasks. It also invokes ffmpeg and ffprobe for media processing and audio gain management.
  • [EXTERNAL_DOWNLOADS]: The workflow integrates external agent skills from the OSideMedia GitHub repository for character design and scene auditing, as well as vendor-specific skills for song generation and platform access.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied audio and lyric transcripts which are used to construct prompts for image and video generation models, creating an attack surface for indirect prompt injection.
  • Ingestion points: External audio files and lyric transcriptions (audio/scribe.json).
  • Boundary markers: The prompt construction logic for scene stills and motion (Steps 7 and 9) does not specify the use of delimiters or warnings to ignore instructions embedded in the lyrics.
  • Capability inventory: Access to shell execution (npx, ffmpeg, ffprobe) and network connectivity to the Recoup API.
  • Sanitization: No explicit sanitization or filtering of transcribed lyric content is mentioned prior to its inclusion in generation prompts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 09:02 AM
Security Audit — agent-trust-hub — recoup-music-video